Data augmentation has been widely used in machine learning with various transformations on a single image  [1]}, e.g., resizing, flipping, rotation, cropping, or multiple images, e.g., MixUp [2]} and CutMix [3]}. Another line of studies [4]}, [5]} works on several self-training schemes by maximizing the pairwise similarity of augmented data. However, the aforementioned methods cannot create new information not included in the given data [6]} since they synthesize and train on similar images. In contrast, adversarial training [7]}, [8]} has been developed to defend against adversarial attacks, which conducts the attack to generate perturbed examples from clean data that the model misclassifies. Then, the generated examples are used as training data to compensate for the model weaknesses, contributing to model robustness. A similar work, MaxUP [9]}, generates a set of random augmented data and searches the hardest example that would maximize the classification loss. However, MaxUp requires numerous random augmented data to explore more information, thus leading to ineffectiveness. In contrast, PGADA directly generates hard samples in a self-supervised manner, which is simpler and computationally efficient.
